Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Revert commit f604259 and fix the MTU problem by allowing only RELATED fragmentation-needed ICMP packets instead of all RELATED connections #4

Closed
wants to merge 1 commit into from
Closed

Revert commit f604259 and fix the MTU problem by allowing only RELATED fragmentation-needed ICMP packets instead of all RELATED connections #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 4 additions & 2 deletions etc/whonix_firewall.d/30_whonix_gateway_default.conf
View file
Open in desktop
Expand Up @@ -281,11 +281,13 @@ NO_REJECT_INVALID_OUTGOING_PACKAGES=0
## 10.0.2.2-10.0.2.24 \
## "

## Drop all incoming ICMP traffic.
## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
## Enable: 1
## Disable: 0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP=0
GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=0

## Setting firewall_mode always to full by default because the following
## usability issues are not yet resolved. Help welcome!
Expand Down
6 changes: 4 additions & 2 deletions etc/whonix_firewall.d/30_whonix_host_default.conf
View file
Open in desktop
Expand Up @@ -68,8 +68,10 @@ NO_REJECT_INVALID_OUTGOING_PACKAGES=0
## 10.0.2.2/24: VirtualBox DHCP
#NON_TOR_GATEWAY="192.168.1.0/24 192.168.0.0/24 127.0.0.0/8 10.152.152.0/24 10.0.2.2/24"

## Drop all incoming ICMP traffic.
## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
## Enable: 1
## Disable: 0
## DISABLED BY DEFAULT
GATEWAY_ALLOW_INCOMING_ICMP=0
GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=0
19 changes: 9 additions & 10 deletions usr/bin/whonix-gateway-firewall
View file
Open in desktop
Expand Up @@ -379,22 +379,21 @@ ipv4_input_rules() {
## Traffic on the loopback interface is accepted.
$iptables_cmd -A INPUT -i lo -j ACCEPT

## Established incoming connections are always accepted.
## Optionally, allow Related incoming connections when
## GATEWAY_ALLOW_INCOMING_RELATED_STATE mode is enabled.
if [ "$GATEWAY_ALLOW_INCOMING_RELATED_STATE" = "1" ]; then
$iptables_cmd -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
else
$iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT
## Established incoming connections are accepted.
$iptables_cmd -A INPUT -m state --state ESTABLISHED -j ACCEPT

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
if [ "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" = "1" ]; then
$iptables_cmd -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT
fi

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
## still be dropped to filter for example ICMP time stamp requests.
if [ ! "$GATEWAY_ALLOW_INCOMING_ICMP" = "1" ]; then
$iptables_cmd -A INPUT -p icmp -j DROP
fi
$iptables_cmd -A INPUT -p icmp -j DROP

## Allow all incoming connections on the virtual VPN network interface,
## when VPN_FIREWALL mode is enabled.
Expand Down
16 changes: 11 additions & 5 deletions usr/bin/whonix-gateway-firewall.nftables
View file
Open in desktop
Expand Up @@ -90,7 +90,7 @@ variables_defaults() {
[ -n "$ALLOW_GATEWAY_ROOT_USER" ] || ALLOW_GATEWAY_ROOT_USER=0
[ -n "$ALLOW_GATEWAY_USER_USER" ] || ALLOW_GATEWAY_USER_USER=0
[ -n "$GATEWAY_ALLOW_INCOMING_SSH" ] || GATEWAY_ALLOW_INCOMING_SSH=0
[ -n "$GATEWAY_ALLOW_INCOMING_ICMP" ] || GATEWAY_ALLOW_INCOMING_ICMP=0
[ -n "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" ] || GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED=0

## Get Tor username, distro specific!
[ -n "$TOR_USER" ] || TOR_USER="$(id -u debian-tor)"
Expand Down Expand Up @@ -439,14 +439,20 @@ nft_input_rules() {
$nftables_cmd add rule ip filter INPUT ct state established counter accept
fi

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
if [ "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" = "1" ]; then
#$iptables_cmd -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT
$nftables_cmd add rule filter INPUT icmp type destination-unreachable icmp code frag-needed ct state related counter accept
fi

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
## still be dropped to filter for example ICMP time stamp requests.
if [ ! "$GATEWAY_ALLOW_INCOMING_ICMP" = "1" ]; then
#$iptables_cmd -A INPUT -p icmp -j DROP
$nftables_cmd add rule ip filter INPUT ip protocol icmp counter drop
fi
#$iptables_cmd -A INPUT -p icmp -j DROP
$nftables_cmd add rule ip filter INPUT ip protocol icmp counter drop

## Allow all incoming connections on the virtual VPN network interface,
## when VPN_FIREWALL mode is enabled.
Expand Down
11 changes: 8 additions & 3 deletions usr/bin/whonix-host-firewall
View file
Open in desktop
Expand Up @@ -147,13 +147,18 @@ iptables -A INPUT -i lo -j ACCEPT
## Established incoming connections are accepted.
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

## Allow fragmentation-needed ICMP packets to avoid MTU problems
## when Whonix Gateway is connected to a link that has smaller
## MTU than 1500 assumed by Whonix Gateway
if [ "$GATEWAY_ALLOW_INCOMING_ICMP_FRAG_NEEDED" = "1" ]; then
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -m state --state RELATED -j ACCEPT
fi

## Drop all incoming ICMP traffic by default.
## All incoming connections are dropped by default anyway, but should a user
## allow incoming ports (such as for incoming SSH or FlashProxy), ICMP should
## still be dropped to filter for example ICMP time stamp requests.
if [ ! "$GATEWAY_ALLOW_INCOMING_ICMP" = "1" ]; then
iptables -A INPUT -p icmp -j DROP
fi
iptables -A INPUT -p icmp -j DROP

## Allow all incoming connections on the virtual VPN network interface,
## when VPN_FIREWALL mode is enabled.
Expand Down